$ ls supabase/reviews/ # the step-back reads
Supabase in review
One review per week (and month): what shipped, what broke, what to act on.
Nov 2–8, 2026 weekly [act] 8 stories
Realtime 2.151 begins capping joins per socket
Behind a socket_join_limit flag, one socket can no longer join unlimited channels, and a high-severity follow-redirects advisory got patc...
Oct 26–Nov 1, 2026 weekly [act] 8 stories
AWS Marketplace becomes a purchase path for Supabase
slim-services republishes postgres and realtime artifacts for arm64 and darwin, and supabase-js stops leaking undefined into Storage head...
Oct 19–25, 2026 weekly [act] 8 stories
Realtime patches cross-tenant channel leak via delimiter injection
etl separately drops a compromised eMudhra root CA and OpenSSL, moving its images to Debian 13; the CLI warns ahead of the v3 local-targe...
Oct 12–18, 2026 weekly [act] 8 stories
MCP server 0.14.0 adds health advisors
The .NET SDK lost its community badge and moved to official support, while realtime patched a decimal-parsing CVE.
Oct 5–11, 2026 weekly [plan] 8 stories
CLI 2.120.0 adds persisted logs and OTel traces
The same period brought loopback bind addresses for native stacks, Realtime presence metrics, and four ClickHouse and Snowflake replicati...
Oct 1–31, 2026 monthly [act] 7 stories
Realtime patches cross-tenant private channel leak
The October fix closes a delimiter injection path in Realtime 2.144.x; CLI 2.120.0 and MCP 0.14.0 carried the month's features.
Sep 28–Oct 4, 2026 weekly [act] 8 stories
Realtime patches HIGH CVE-2026-91043 in mint
Realtime 2.140.0 splits tenant and cluster metrics endpoints, while Realtime also fixed dropped RLS-authorized inserts and two reconnect ...
Sep 21–27, 2026 weekly [act] 8 stories
Recovery-code MFA sign-in ships as Classic Dark retires
Realtime also stops refreshing tokens on every request, and ETL removes etl-api while SCRAM channel binding returns over TLS.
Sep 14–20, 2026 weekly [act] 8 stories
Studio moves to Nitro, CLI stack goes flag-gated
Supabase's week split three ways: self-hosting artifacts, experimental CLI stack controls, and a TypeScript server rewrite.
Sep 7–13, 2026 weekly 6 stories
Supabase CLI adds stack service selection
Slim-services publishes smoke-tested multi-platform images for eleven services, and Studio Explorer splits its SQL editor and results.
Sep 1–30, 2026 monthly [act] 7 stories
MCP v0.12.0 groups advisor lints, adds cost elicitation
September's CLI work centered on a flag-gated stack, while the slim-services images moved PostgREST to v16.3 and Storage to v1.79.4.
Aug 31–Sep 6, 2026 weekly [plan]
Knip gates Studio CI, CLI fixes schema skip
Studio now fails CI on dead code, CLI stops skipping colliding schemas, and DuckDB pools connections.
Aug 24–30, 2026 weekly
Notebook protection, server middleware, and CI maturity lead the week
The week's release went beyond daily fixes: Supabase hardened its notebook and CLI workflows, expanded its server middleware suite, and m...
Aug 1–31, 2026 monthly
Supabase ships CLI v2, Postgres middleware, and safety rails across Studio
August 2026 saw Supabase mature its tooling with a stable CLI release, new Postgres middleware pair, and a suite of safety features in St...
Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.